PT-2010-2962 · Microsoft · Office Infopath+4

Chris Weber · Published 2010-06-08 · Updated 2023-12-07 · CVE-2010-1257

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Office InfoPath versions 2003 SP3 through 2007 SP2 Office SharePoint Server versions 2007 SP1 through 2007 SP2 SharePoint Services versions 3.0 SP1 through 3.0 SP2 Internet Explorer version 8

Description The issue is related to a cross-site scripting (XSS) vulnerability in the toStaticHTML API. This vulnerability allows remote attackers to inject arbitrary web script or HTML via vectors related to sanitization, potentially leading to information disclosure. An attacker could exploit this vulnerability by constructing a specially crafted Web page, allowing the attacker to execute script in the user's security context against a site that is using the toStaticHTML API.

Recommendations For Microsoft Office InfoPath versions 2003 SP3 through 2007 SP2, consider disabling the toStaticHTML API until a patch is available. For Office SharePoint Server versions 2007 SP1 through 2007 SP2, restrict access to the toStaticHTML API to minimize the risk of exploitation. For SharePoint Services versions 3.0 SP1 through 3.0 SP2, avoid using the toStaticHTML API in sensitive operations until the issue is resolved. For Internet Explorer version 8, as a temporary workaround, consider disabling the toStaticHTML() function until a patch is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2010-1257

Affected Products

Internet Explorer

Office Infopath

Office Sharepoint Server

Sharepoint Services

Sharepoint Server

References · 12

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-035 · Vendor Advisory
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-039 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-1257 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1257 · Security Note
• http://support.avaya.com/css/P8/documents/100089747 · Note
• https://docs.microsoft.com/security-updates/securitybulletins/2010/MS10-035 · Note
• http://us-cert.gov/cas/techalerts/TA10-159B.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/58866 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6677 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1257 · Note
• https://docs.microsoft.com/security-updates/securitybulletins/2010/MS10-039 · Note
• http://securityfocus.com/bid/40409 · Note